The Platform / Agents / Workforce Lifecycle Manager
HR records the change. XOPS makes it true everywhere.
Employee onboarding and offboarding automation for IT, HR and security teams: every joiner, mover, leave and leaver carried through identity, devices, software, workplace and finance, and verified in each system. Access Governance removes the access a leaver should no longer have, and Cencora’s contractor lifecycle shows the result.
One HR change. Seven systems. One event creates seven obligations. XOPS owns their completion.
Hand itEvery joiner, mover and leaver, closed across every system.
Meet your autonomous Workforce Lifecycle Manager.
It takes responsibility for every workforce change, for employees, contractors and interns alike: joiners, movers, leaves of absence and leavers. It detects the change in HR, determines what it requires across identity, devices, software, communications, workplace, payroll and finance, executes those changes, and verifies that every system reflects them.
A new hire’s accounts, laptop, apps and badge are ready by their start time. A role or country change adjusts access and equipment together. A leave suspends and restores access cleanly. A departure closes accounts, reclaims licenses, initiates device recovery with chain of custody, and verifies that nothing is left unresolved. Anything it can’t complete reaches your team early, with the blocker named.
Works for: Workforce lifecycles and the IT teams that onboard and offboard people
Watch the Workforce Lifecycle Manager work
The cost of a half-finished transition
When a joiner or leaver stops halfway, the cost leaks out of four places at once.
Licenses still assigned
Seats stay billed to someone who has left until somebody notices.
Devices never recovered
Laptops sit in former employees’ homes, holding company data and losing value, while new ones are ordered.
Accounts left active
Access that outlives employment is the gap auditors look for first, and attackers look for too.
Hours spent reconciling
People compare HR, identity and asset records by hand to find what was missed, every week.
XOPS closes the whole transition, so none of it accumulates.
A leaver is a Workday, Okta and Intune event at once, and only one finds out first. The agent resolves them to one person and acts across all three.
Customer proof
Cencora · Pharmaceutical
From contractor churn to an autonomous joiner, mover and leaver engine.
Cencora processes thousands of employee and contractor transitions a month. Contractor onboarding and offboarding once ate more than 100 hours of operations time every week, and devices were rarely recovered. Now each transition runs as one governed outcome, with license reclaim and chain-of-custody device recovery built in.
92%
Of contractor lifecycle work runs with no human intervention
89 → 1
People sharing onboarding and offboarding work, down to one part-time person
100+ hrs
Operations time saved per week
25% → 70%
Device recovery rate
See a contractor become an employee mid-contract. See how it works
What the Workforce Lifecycle Manager agent delivers
Joiner
Day 1 · joins Marketing
Mover
Month 14 · moves to Sales
Leave
Month 30 · parental leave
Leaver
Month 41 · leaves
One employee, four transitions. Every resource moves with the employee’s state, and XOPS verifies each change.
Joiners
Reads the hire from HR, takes a device from stock or orders one within policy, sets software and access by role and location, provisions accounts in order, tracks the shipment, sets the badge and confirms the person can log in.
Movers
Compares the old role with the new one, removes access the new role doesn’t need, grants what it does, swaps equipment when the role calls for it, and updates cost center and pay routing.
Leave
Suspends access on the first day of leave, delegates approvals, decides who covers the mailbox for the Communications Manager to apply, holds the device and licenses, and restores everything on return.
Leavers
On the last day, disables accounts, revokes access and keys, returns licenses to the pool, starts device recovery with chain of custody, and verifies that no system still treats the person as active.
Its authority
Does on its own, within your policy
Asks before it acts
Escalates to your team
You set the autonomy level for each play, from recommend-only to run within policy.
Agents run the job. XOPS executes the actions. People set the policy and own the exceptions.
The Workforce Lifecycle Manager owns the outcome: a person who has left is no longer active anywhere. The agents that own each system finish their part, and it verifies the whole.
Priya Nair leaves on Friday
✓ Departure complete: no system still treats her as active
Illustrative.
Illustrative scenario
Without the agent
200 hires. 200 separate journeys to readiness.
HR finalizes the cohort on Tuesday. Tickets fill three regional queues, and on Monday most people start their first week waiting.
With the agent
186 ready. 14 exceptions identified and assigned.
On Tuesday, 200 outcomes start in parallel. XOPS completes everything in its control and surfaces every dependency it can’t clear, days before anyone starts.
One HR signal. Every dependency visible before day one.
Illustrative scenario. These numbers are not a customer result.
The job description
Role
Workforce lifecycle manager
Works across
HR, identity, ITSM, endpoint, SaaS, workplace, payroll, finance
Authority
What you delegate, within your access policy
Measured on
People ready and access closed on time, not tickets closed
Responsibility
What it does
Done means
1Catch every change
“Who starts, moves or leaves this month, and which HR records arrived late?”
What it does
Detects joiners, movers, leaves and leavers in HR for employees, contractors and interns, checks each record against identity and the other systems, and measures how late HR entries arrive.
Done means
Every transition starts the day HR records it. Discrepancies go to the record owner; HR stays the system of record.
2Have joiners ready on day one
“Will everyone starting Monday be able to work?”
What it does
Starts every dependency the moment the hire is recorded: accounts, laptop and the role’s software bundle, with badge and desk set up by the Workplace Manager and mailbox and Teams line by the Communications Manager. Access waits until HR confirms preconditions are cleared.
Done means
The person can log in and work at their start time, and every blocker was visible days before.
3Move access with the role
“What should change for this person moving from London to Singapore?”
What it does
Compares the old role with the new one, removes access the new role doesn’t need, grants what it does, swaps equipment and updates cost center, legal entity and pay routing. The Workplace Manager moves site access; the Communications Manager moves the phone number and emergency location.
Done means
No access left over from the old role, and finance shows the new cost center.
4Suspend and restore for leave
“Who returns from leave next week?”
What it does
Suspends access on the first day of leave, delegates approvals, decides who covers the mailbox for the Communications Manager to apply, holds the device and licenses, and restores everything on return, working only from leave status and dates.
Done means
Everything restored on the return date. The reason for the leave is never seen.
5Close every departure
“Which leavers still have active access?”
What it does
Decides who receives the mailbox, transfers files and approvals, and has the owning agents close accounts, reclaim licenses, recover the device with chain of custody and revoke API keys. The Communications Manager converts the mailbox, cleans up lists and retires the number, with retention and legal holds preserved, and the Workplace Manager deactivates the badge.
Done means
The footprint is verified closed in every system, not just in HR.
6Handle confidential exits
“Prepare this termination for 3 p.m. on Friday.”
What it does
Prepares involuntary terminations and reductions in force with no visible tickets or notifications, then revokes access, ends sessions and locks devices at the time you set.
Done means
Access gone at the minute specified, and nothing disclosed beforehand.
7Run the contingent workforce
“Which contractors end this month without an extension?”
What it does
Tracks contractor start and end dates, extensions and conversions, closes access at contract end and routes every extension for approval.
Done means
No contractor stays active past contract end without an approved extension.
8Prove it for audit
“Show that every leaver last quarter lost access on time.”
What it does
Reconciles every footprint against HR to find orphaned access, keeps the evidence for each transition and supports access recertification.
Done means
Evidence for every transition, on demand.
Talk to it like you would your workforce lifecycle lead.
1. Ask it
“Which leavers still have active access?”
2. Have it decide
“What should change for this person moving from London to Singapore?”
3. Have it do it
“Close out everyone leaving this week and report anything unresolved.”
Bring us a real departure. We’ll show it reconciled and closed across identity, software, devices and workplace systems, with every step verified.
